Re: [gentoo-portage-dev] [PATCH] bin/ebuild-helpers/portageq: fix bug #524964
On 10/11/2014 12:17 AM, Michał Górny wrote:
> Dnia 2014-10-10, o godz. 21:50:53
> Zac Medico napisał(a):
>> +
>> +IFS=':'
>> +
>> +for path in ${PATH}; do
>
> This will trigger unwanted filename expansion. For example,
>
> PATH='/*/bin'
>
> will trigger '/usr/bin' rather than '/*/bin' :P.
Good catch, thanks. This version uses 'set -f' to fix that:
>From d16a4eb704fd91a60341daef7b31dcede7f17bf5 Mon Sep 17 00:00:00 2001
From: Zac Medico
Date: Fri, 10 Oct 2014 21:32:54 -0700
Subject: [PATCH] bin/ebuild-helpers/portageq: fix bug #524964
Since commit 0cc4c1ac21a2ea94cfb1f6ff4b461a9e349d47df,
$PORTAGE_BIN_PATH/portageq no longer exists, which breaks
bin/ebuild-helpers/portageq. Note that has_version and best_version
rely on bin/ebuild-helpers/portageq if IPC is disabled, so breakage
extends beyond ebuilds that call portageq "illegally". Since
$PORTAGE_BIN_PATH no longer works, use PATH to locate the real
portageq python script.
Fixes: 0cc4c1ac21a2 ("Install Portage using setup.py")
X-Gento-Bug: 524964
X-Gentoo-URL: https://bugs.gentoo.org/show_bug.cgi?id=524964
---
bin/ebuild-helpers/portageq | 20 ++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/bin/ebuild-helpers/portageq b/bin/ebuild-helpers/portageq
index b67b03f..4151bac 100755
--- a/bin/ebuild-helpers/portageq
+++ b/bin/ebuild-helpers/portageq
@@ -2,9 +2,25 @@
# Copyright 2009-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
+scriptpath=${BASH_SOURCE[0]}
+scriptname=${scriptpath##*/}
+
PORTAGE_BIN_PATH=${PORTAGE_BIN_PATH:-/usr/lib/portage/bin}
PORTAGE_PYM_PATH=${PORTAGE_PYM_PATH:-/usr/lib/portage/pym}
# Use safe cwd, avoiding unsafe import for bug #469338.
cd "${PORTAGE_PYM_PATH}"
-PYTHONPATH=${PORTAGE_PYTHONPATH:-${PORTAGE_PYM_PATH}} \
- exec "${PORTAGE_PYTHON:-/usr/bin/python}" "$PORTAGE_BIN_PATH/portageq"
"$@"
+
+IFS=':'
+set -f # in case ${PATH} contains any shell glob characters
+
+for path in ${PATH}; do
+ [[ -x ${path}/${scriptname} ]] || continue
+ [[ ${path}/${scriptname} -ef ${scriptpath} ]] && continue
+ PYTHONPATH=${PORTAGE_PYTHONPATH:-${PORTAGE_PYM_PATH}} \
+ exec "${PORTAGE_PYTHON:-/usr/bin/python}" \
+ "${path}/${scriptname}" "$@"
+done
+
+unset IFS
+echo "${scriptname}: command not found" 1>&2
+exit 127
--
1.8.5.5
Re: [gentoo-portage-dev] [PATCH] bin/ebuild-helpers/portageq: fix bug #524964
Dnia 2014-10-10, o godz. 21:50:53
Zac Medico napisał(a):
> Since commit 0cc4c1ac21a2ea94cfb1f6ff4b461a9e349d47df,
> $PORTAGE_BIN_PATH/portageq no longer exists, which breaks
> bin/ebuild-helpers/portageq. Note that has_version and best_version
> rely on bin/ebuild-helpers/portageq if IPC is disabled, so breakage
> extends beyond ebuilds that call portageq "illegally". Since
> $PORTAGE_BIN_PATH no longer works, use PATH to locate the real
> portageq python script.
>
> Fixes: 0cc4c1ac21a2 ("Install Portage using setup.py")
> X-Gento-Bug: 524964
> X-Gentoo-URL: https://bugs.gentoo.org/show_bug.cgi?id=524964
> ---
> bin/ebuild-helpers/portageq | 19 +--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
> diff --git a/bin/ebuild-helpers/portageq b/bin/ebuild-helpers/portageq
> index b67b03f..9eb17fc 100755
> --- a/bin/ebuild-helpers/portageq
> +++ b/bin/ebuild-helpers/portageq
> @@ -2,9 +2,24 @@
> # Copyright 2009-2013 Gentoo Foundation
> # Distributed under the terms of the GNU General Public License v2
>
> +scriptpath=${BASH_SOURCE[0]}
> +scriptname=${scriptpath##*/}
> +
> PORTAGE_BIN_PATH=${PORTAGE_BIN_PATH:-/usr/lib/portage/bin}
> PORTAGE_PYM_PATH=${PORTAGE_PYM_PATH:-/usr/lib/portage/pym}
> # Use safe cwd, avoiding unsafe import for bug #469338.
> cd "${PORTAGE_PYM_PATH}"
> -PYTHONPATH=${PORTAGE_PYTHONPATH:-${PORTAGE_PYM_PATH}} \
> - exec "${PORTAGE_PYTHON:-/usr/bin/python}" "$PORTAGE_BIN_PATH/portageq"
> "$@"
> +
> +IFS=':'
> +
> +for path in ${PATH}; do
This will trigger unwanted filename expansion. For example,
PATH='/*/bin'
will trigger '/usr/bin' rather than '/*/bin' :P.
> + [[ -x ${path}/${scriptname} ]] || continue
> + [[ ${path}/${scriptname} -ef ${scriptpath} ]] && continue
> + PYTHONPATH=${PORTAGE_PYTHONPATH:-${PORTAGE_PYM_PATH}} \
> + exec "${PORTAGE_PYTHON:-/usr/bin/python}" \
> + "${path}/${scriptname}" "$@"
> +done
> +
> +unset IFS
> +echo "${scriptname}: command not found" 1>&2
> +exit 127
--
Best regards,
Michał Górny
signature.asc
Description: PGP signature
[gentoo-portage-dev] [PATCH] bin/ebuild-helpers/portageq: fix bug #524964
Since commit 0cc4c1ac21a2ea94cfb1f6ff4b461a9e349d47df,
$PORTAGE_BIN_PATH/portageq no longer exists, which breaks
bin/ebuild-helpers/portageq. Note that has_version and best_version
rely on bin/ebuild-helpers/portageq if IPC is disabled, so breakage
extends beyond ebuilds that call portageq "illegally". Since
$PORTAGE_BIN_PATH no longer works, use PATH to locate the real
portageq python script.
Fixes: 0cc4c1ac21a2 ("Install Portage using setup.py")
X-Gento-Bug: 524964
X-Gentoo-URL: https://bugs.gentoo.org/show_bug.cgi?id=524964
---
bin/ebuild-helpers/portageq | 19 +--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/bin/ebuild-helpers/portageq b/bin/ebuild-helpers/portageq
index b67b03f..9eb17fc 100755
--- a/bin/ebuild-helpers/portageq
+++ b/bin/ebuild-helpers/portageq
@@ -2,9 +2,24 @@
# Copyright 2009-2013 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
+scriptpath=${BASH_SOURCE[0]}
+scriptname=${scriptpath##*/}
+
PORTAGE_BIN_PATH=${PORTAGE_BIN_PATH:-/usr/lib/portage/bin}
PORTAGE_PYM_PATH=${PORTAGE_PYM_PATH:-/usr/lib/portage/pym}
# Use safe cwd, avoiding unsafe import for bug #469338.
cd "${PORTAGE_PYM_PATH}"
-PYTHONPATH=${PORTAGE_PYTHONPATH:-${PORTAGE_PYM_PATH}} \
- exec "${PORTAGE_PYTHON:-/usr/bin/python}" "$PORTAGE_BIN_PATH/portageq"
"$@"
+
+IFS=':'
+
+for path in ${PATH}; do
+ [[ -x ${path}/${scriptname} ]] || continue
+ [[ ${path}/${scriptname} -ef ${scriptpath} ]] && continue
+ PYTHONPATH=${PORTAGE_PYTHONPATH:-${PORTAGE_PYM_PATH}} \
+ exec "${PORTAGE_PYTHON:-/usr/bin/python}" \
+ "${path}/${scriptname}" "$@"
+done
+
+unset IFS
+echo "${scriptname}: command not found" 1>&2
+exit 127
--
1.8.5.5
